summaryrefslogtreecommitdiffstats
path: root/hw/net/e1000.c
diff options
context:
space:
mode:
authorJason Wang2021-02-24 05:13:22 +0100
committerJason Wang2021-03-15 09:41:22 +0100
commit1caff0340f49c93d535c6558a5138d20d475315c (patch)
treec7bfab49856f2cb976c35e7f8faffd796bcdec1b /hw/net/e1000.c
parentnet: introduce qemu_receive_packet() (diff)
downloadqemu-1caff0340f49c93d535c6558a5138d20d475315c.tar.gz
qemu-1caff0340f49c93d535c6558a5138d20d475315c.tar.xz
qemu-1caff0340f49c93d535c6558a5138d20d475315c.zip
e1000: switch to use qemu_receive_packet() for loopback
This patch switches to use qemu_receive_packet() which can detect reentrancy and return early. This is intended to address CVE-2021-3416. Cc: Prasad J Pandit <ppandit@redhat.com> Cc: qemu-stable@nongnu.org Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
Diffstat (limited to 'hw/net/e1000.c')
-rw-r--r--hw/net/e1000.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/hw/net/e1000.c b/hw/net/e1000.c
index 4345d863e6..4f75b44cfc 100644
--- a/hw/net/e1000.c
+++ b/hw/net/e1000.c
@@ -546,7 +546,7 @@ e1000_send_packet(E1000State *s, const uint8_t *buf, int size)
NetClientState *nc = qemu_get_queue(s->nic);
if (s->phy_reg[PHY_CTRL] & MII_CR_LOOPBACK) {
- nc->info->receive(nc, buf, size);
+ qemu_receive_packet(nc, buf, size);
} else {
qemu_send_packet(nc, buf, size);
}